On Wed, May 06 2020, Okan Demirmen <[email protected]> wrote:
> another recently discovered xss with mailman, again based on a cve from
> 2018; this one doesn't yet have a cve assigned; upstream fix.
>
> if this does not make 6.7, post-unlock, i'd like to apply to 6.6 and 6.7
> -stable if okay.
>
> from changelog:
>
> 2.1.32 (05-May-2020)
>
> i18n
>
> Fixed a typo in the Spanish translation and uptated mailman.pot and
> the message catalog for 2.1.31 security fix.
>
> 2.1.31 (05-May-2020)
>
> Security
>
> - A content injection vulnerability via the options login page has been
> discovered and reported by Vishal Singh. This is fixed. (LP: #1873722)
>
> i18n
>
> - The Spanish translation has been updated by Omar Walid Llorente.
>
> Bug Fixes and other patches
>
> - Bounce recognition for a non-compliant Yahoo format is added.
>
> - Archiving workaround for non-ascii in string.lowercase in some Python
> packages is added.
>
> diff for current and -stable.
Apart from the churn in the .po files, the tarball diff is short.
The changes look safe to me, ok jca@
--8<--
diff -pruN
/usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Archiver/pipermail.py
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Archiver/pipermail.py
--- /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Archiver/pipermail.py
Wed May 6 16:23:25 2020
+++ /usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Archiver/pipermail.py
Wed May 6 16:24:09 2020
@@ -12,6 +12,10 @@ import cPickle as pickle
from cStringIO import StringIO
from string import lowercase
+# Work around for some misguided Python packages that add iso-8859-1
+# accented characters to string.lowercase.
+lowercase = lowercase[:26]
+
__version__ = '0.09 (Mailman edition)'
VERSION = __version__
CACHESIZE = 100 # Number of slots in the cache
diff -pruN
/usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Archiver/pipermail.py.orig
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Archiver/pipermail.py.orig
---
/usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Archiver/pipermail.py.orig
Mon Apr 13 19:08:14 2020
+++
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Archiver/pipermail.py.orig
Tue May 5 22:01:52 2020
@@ -12,6 +12,10 @@ import cPickle as pickle
from cStringIO import StringIO
from string import lowercase
+# Work around for some misguided Python packages that add iso-8859-1
+# accented characters to string.lowercase.
+lowercase = lowercase[:26]
+
__version__ = '0.09 (Mailman edition)'
VERSION = __version__
CACHESIZE = 100 # Number of slots in the cache
diff -pruN
/usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Bouncers/SimpleMatch.py
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Bouncers/SimpleMatch.py
---
/usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Bouncers/SimpleMatch.py
Mon Apr 13 19:08:14 2020
+++
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Bouncers/SimpleMatch.py
Tue May 5 22:01:52 2020
@@ -195,6 +195,10 @@ PATTERNS = [
(_c('Message could not be delivered to some recipients.'),
_c('Message headers follow'),
_c('Recipient: \[SMTP:(?P<addr>[^\s@]+@[^\s@]+)\]')),
+ # This one is from Yahoo but dosen't fit the yahoo recognizer format
+ (_c(r'wasn\'t able to deliver the following message'),
+ _c(r'---Below this line is a copy of the message.'),
+ _c(r'To: (?P<addr>[^\s@]+@[^\s@]+)')),
# Next one goes here...
]
diff -pruN /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Cgi/options.py
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Cgi/options.py
--- /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Cgi/options.py
Mon Apr 13 19:08:14 2020
+++ /usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Cgi/options.py
Tue May 5 22:01:52 2020
@@ -173,7 +173,7 @@ def main():
try:
Utils.ValidateEmail(user)
except Errors.EmailAddressError:
- doc.addError(_('Illegal Email Address: %(safeuser)s'))
+ doc.addError(_('Illegal Email Address'))
loginpage(mlist, doc, None, language)
print doc.Format()
return
diff -pruN /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Version.py
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Version.py
--- /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/Mailman/Version.py Mon Apr
13 19:08:14 2020
+++ /usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/Mailman/Version.py Tue May
5 22:01:52 2020
@@ -16,7 +16,7 @@
# USA.
# Mailman version
-VERSION = '2.1.30'
+VERSION = '2.1.32'
# And as a hex number in the manner of PY_VERSION_HEX
ALPHA = 0xa
@@ -28,7 +28,7 @@ FINAL = 0xf
MAJOR_REV = 2
MINOR_REV = 1
-MICRO_REV = 30
+MICRO_REV = 32
REL_LEVEL = FINAL
# at most 15 beta releases!
REL_SERIAL = 0
diff -pruN /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/NEWS
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/NEWS
--- /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/NEWS Mon Apr 13 19:08:14 2020
+++ /usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/NEWS Tue May 5 22:01:52 2020
@@ -5,6 +5,31 @@ Copyright (C) 1998-2018 by the Free Software Foundatio
Here is a history of user visible changes to Mailman.
+2.1.32 (05-May-2020)
+
+ i18n
+
+ Fixed a typo in the Spanish translation and uptated mailman.pot and
+ the message catalog for 2.1.31 security fix.
+
+2.1.31 (05-May-2020)
+
+ Security
+
+ - A content injection vulnerability via the options login page has been
+ discovered and reported by Vishal Singh. This is fixed. (LP: #1873722)
+
+ i18n
+
+ - The Spanish translation has been updated by Omar Walid Llorente.
+
+ Bug Fixes and other patches
+
+ - Bounce recognition for a non-compliant Yahoo format is added.
+
+ - Archiving workaround for non-ascii in string.lowercase in some Python
+ packages is added.
+
2.1.30 (13-Apr-2020)
New Features
diff -pruN
/usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/tests/bounces/yahoo_12.txt
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/tests/bounces/yahoo_12.txt
--- /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/tests/bounces/yahoo_12.txt
Thu Jan 1 01:00:00 1970
+++ /usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/tests/bounces/yahoo_12.txt
Tue May 5 22:01:52 2020
@@ -0,0 +1,18 @@
+From: [email protected]
+To: [email protected]
+Message-ID:
<1724157855.37526491587724620658.javamail.ya...@mpq204.consmr.mail.bf2.yahoo.com>
+MIME-Version: 1.0
+Content-Type: text/html; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+Message-ID-Hash: NMFBS7K2KRA44XW6KCW6CW6NNKCXESHM
+X-Message-ID-Hash: NMFBS7K2KRA44XW6KCW6CW6NNKCXESHM
+X-MailFrom: [email protected]
+
+I'm afraid I wasn't able to deliver the following message.
+This is a permanent error; I've given up. Sorry it didn't work out.
+
+Subject: [List] Re: Name for MP3 Folder
+To: [email protected]
+
+---Below this line is a copy of the message.
+
diff -pruN /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/tests/test_bounces.py
/usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/tests/test_bounces.py
--- /usr/ports/pobj/mailman-2.1.30/mailman-2.1.30/tests/test_bounces.py Mon Apr
13 19:08:14 2020
+++ /usr/ports/pobj/mailman-2.1.32/mailman-2.1.32/tests/test_bounces.py Tue May
5 22:01:52 2020
@@ -84,6 +84,7 @@ class BounceTest(unittest.TestCase):
('SimpleMatch', 'simple_41.txt', ['[email protected]']),
('SimpleMatch', 'bounce_02.txt', ['[email protected]']),
('SimpleMatch', 'bounce_03.txt', ['[email protected]']),
+ ('SimpleMatch', 'yahoo_12.txt', ['[email protected]']),
# SimpleWarning
('SimpleWarning', 'simple_03.txt', Stop),
('SimpleWarning', 'simple_21.txt', Stop),
-->8--
--
jca | PGP : 0x1524E7EE / 5135 92C1 AD36 5293 2BDF DDCC 0DFA 74AE 1524 E7EE
